CRISC Certification: Domains and Study Plan
CRISC (Certified in Risk and Information Systems Control) is ISACA's risk-management credential. ISACA lists four domains: Corporate IT Governance, Risk Assessment, Risk Response and Reporting, and Technology and Security. The exam fee is US$575 for members and US$760 for non-members (ISACA, checked 3 November 2026).
Below: the domains in our words, a study plan, and risk labs to practise the skills. It does not replace ISACA's official outline.
Updated 3 November 2026
The four domains, mapped to practice
| Domain | In plain words | Practise with |
|---|---|---|
| Corporate IT Governance | How an organisation sets risk appetite, roles and policies so IT risk is owned. | Risk Appetite Lab |
| Risk Assessment | Identifying threats and vulnerabilities, estimating likelihood and impact, analysing scenarios. | Risk Register, Risk Quantification Lab |
| Risk Response and Reporting | Choosing to mitigate, transfer, avoid or accept, then tracking and reporting. | ALE Calculator, FAIR ALE |
| Technology and Security | Understanding the controls and technologies that treat the risk, and how to test them. | NIST CSF tool, ISMS Builder |
A study plan
- Check the rules on ISACA. Confirm experience and application steps first.
- Build one risk register end to end. Ten risks, scored, owned, with treatments.
- Quantify two risks. Use the ALE tools to express loss in money and compare treatments.
- Practise reporting. Write a half-page risk summary for a board in plain language.
- Review technologies. Learn what controls do, using NIST CSF 2.0 as a map.
- Question practice. Use ISACA's official questions and review every miss by domain.
Where it fits
CRISC suits GRC analysts, risk managers and auditors. Read What is GRC? for the field, CISM if you are heading toward programme leadership, and the certifications guide for all the options.
Frequently asked questions
What is the CRISC certification?
CRISC stands for Certified in Risk and Information Systems Control, issued by ISACA. It is aimed at people who identify and manage IT and enterprise risk and design or monitor risk controls. ISACA lists four domains: Corporate IT Governance, Risk Assessment, Risk Response and Reporting, and Technology and Security.
What are the CRISC domains?
ISACA lists four: Corporate IT Governance, Risk Assessment, Risk Response and Reporting, and Technology and Security. Confirm current weightings on ISACA; we do not reproduce them.
How much does CRISC cost?
ISACA lists US$575 for members and US$760 for non-members on its CRISC page (checked 3 November 2026). Confirm on ISACA before booking.
What experience does CRISC need?
ISACA says candidates must submit an application to demonstrate experience requirements and links to a separate support article. We could not verify the exact years from the certification page, so check ISACA directly.
CRISC or CISM?
CRISC is specialised in risk: assessing it, responding to it and reporting it. CISM covers managing the whole security programme, including incident management. Risk and audit people often choose CRISC; people heading to security management often choose CISM.
Does CRISC raise pay?
BLS does not measure pay by certification, so we give no figure. See the salary explorer for pay by role.
Is PlayCISO affiliated with ISACA?
No. PlayCISO is not a certification body. Our risk labs give practice on the skills the domains describe.